{"id":"https://openalex.org/W7128375921","doi":"https://doi.org/10.48550/arxiv.2602.06466","title":"Auditing Rust Crates Effectively","display_name":"Auditing Rust Crates Effectively","publication_year":2026,"publication_date":"2026-02-06","ids":{"openalex":"https://openalex.org/W7128375921","doi":"https://doi.org/10.48550/arxiv.2602.06466"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2602.06466","doi":"https://doi.org/10.48550/arxiv.2602.06466","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2602.06466","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"volume":null,"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2602.06466","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5125403952","display_name":"Lydia Zoghbi","orcid":"https://orcid.org/0009-0008-5735-6768","observed_orcids":["https://orcid.org/0009-0008-5735-6768"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zoghbi, Lydia","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5085748983","display_name":"David Thien","orcid":"https://orcid.org/0009-0003-3840-051X","observed_orcids":["https://orcid.org/0009-0003-3840-051X"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Thien, David","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5002412544","display_name":"Ranjit Jhala","orcid":"https://orcid.org/0000-0002-1802-9421","observed_orcids":["https://orcid.org/0000-0002-1802-9421"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jhala, Ranjit","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5082723061","display_name":"Deian Stefan","orcid":"https://orcid.org/0000-0002-7041-7464","observed_orcids":["https://orcid.org/0000-0002-7041-7464"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Stefan, Deian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5019472033","display_name":"Caleb Stanford","orcid":"https://orcid.org/0000-0002-8428-7736","observed_orcids":["https://orcid.org/0000-0002-8428-7736"]},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Stanford, Caleb","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.357699990272522,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10260","display_name":"Software Engineering Research","score":0.357699990272522,"subfield":{"id":"https://openalex.org/subfields/1710","display_name":"Information Systems"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10126","display_name":"Logic, programming, and type systems","score":0.3257000148296356,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10743","display_name":"Software Testing and Debugging Techniques","score":0.12780000269412994,"subfield":{"id":"https://openalex.org/subfields/1712","display_name":"Software"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/rust-programming-language","display_name":"Rust","score":0.5830000042915344},{"id":"https://openalex.org/keywords/transitive-dependencies","display_name":"transitive dependencies","score":0.9390000104904175},{"id":"https://openalex.org/keywords/side-effect-analysis","display_name":"side-effect analysis","score":0.7900000214576721},{"id":"https://openalex.org/keywords/call-graph","display_name":"call graph","score":0.6700000166893005},{"id":"https://openalex.org/keywords/type-systems","display_name":"type systems","score":0.32100000977516174},{"id":"https://openalex.org/keywords/module-system","display_name":"module system","score":0.8690000176429749}],"concepts":[{"id":"https://openalex.org/C199521495","wikidata":"https://www.wikidata.org/wiki/Q181487","display_name":"Audit","level":2,"score":0.8090000152587891},{"id":"https://openalex.org/C2776760102","wikidata":"https://www.wikidata.org/wiki/Q5139990","display_name":"Code (set theory)","level":3,"score":0.612500011920929},{"id":"https://openalex.org/C2779343474","wikidata":"https://www.wikidata.org/wiki/Q3109175","display_name":"Context (archaeology)","level":2,"score":0.5874000191688538},{"id":"https://openalex.org/C197781089","wikidata":"https://www.wikidata.org/wiki/Q575650","display_name":"Rust (programming language)","level":2,"score":0.491100013256073},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.4848000109195709},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.3603000044822693},{"id":"https://openalex.org/C126831891","wikidata":"https://www.wikidata.org/wiki/Q221673","display_name":"Host (biology)","level":2,"score":0.3467999994754791},{"id":"https://openalex.org/C2781188742","wikidata":"https://www.wikidata.org/wiki/Q605384","display_name":"Crate","level":2,"score":0.33160001039505005},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3124000132083893},{"id":"https://openalex.org/C199519371","wikidata":"https://www.wikidata.org/wiki/Q942695","display_name":"Source lines of code","level":3,"score":0.3075999915599823},{"id":"https://openalex.org/C14036430","wikidata":"https://www.wikidata.org/wiki/Q3736076","display_name":"Function (biology)","level":2,"score":0.2888999879360199},{"id":"https://openalex.org/C39358052","wikidata":"https://www.wikidata.org/wiki/Q2578632","display_name":"Information security audit","level":5,"score":0.28119999170303345},{"id":"https://openalex.org/C115903868","wikidata":"https://www.wikidata.org/wiki/Q80993","display_name":"Software engineering","level":1,"score":0.2549999952316284}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2602.06466","doi":"https://doi.org/10.48550/arxiv.2602.06466","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2602.06466","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2602.06466","doi":"https://doi.org/10.48550/arxiv.2602.06466","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2602.06466","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"sustainable_development_goals_aurora":[],"study_designs":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"We":[0],"introduce":[1],"Cargo":[2,93,168,197,220,256],"Scan,":[3],"the":[4,77,87,133,143,150,163,203,224,248,263,272,284],"first":[5],"interactive":[6],"program":[7],"analysis":[8],"tool":[9],"designed":[10],"to":[11,75,84,86,108,110,231,242],"help":[12],"developers":[13,82,125],"audit":[14,178,184,202],"third-party":[15],"Rust":[16,22,35,194,249],"code.":[17,58],"Real":[18],"systems":[19],"written":[20],"in":[21,34,39,290],"rely":[23],"on":[24,149,267],"thousands":[25],"of":[26,57,69,79,145,213,227,234,236,238,262,271,283,293],"transitive":[27],"dependencies.":[28],"These":[29],"dependencies":[30,50],"are":[31,38,288],"as":[32,36,100,269],"dangerous":[33,98,137,229,286],"they":[37],"other":[40],"languages":[41],"(e.g.,":[42],"C":[43],"or":[44],"JavaScript)":[45],"--":[46,153],"and":[47,72,102,113,118,130,176,182,206,211],"auditing":[48,193,225,243],"these":[49,294],"today":[51],"means":[52],"manually":[53],"inspecting":[54],"every":[55],"line":[56],"Unlike":[59],"for":[60],"most":[61,122,282],"industrial":[62],"languages,":[63],"though,":[64],"we":[65,189,201,253,279],"can":[66,126,222,258],"take":[67],"advantage":[68],"Rust's":[70],"type":[71],"module":[73,119],"system":[74],"minimize":[76],"amount":[78],"code":[80,88,99,134,230,239],"that":[81,89,219,255,274,281],"need":[83],"inspect":[85,127],"is":[90,135,157],"potentially":[91,97,136,159,228,285],"dangerous.":[92],"Scan":[94,169,221,257],"models":[95],"such":[96],"effects":[101,112,129],"performs":[103],"a":[104,155,161,174,232],"side-effects":[105,287],"analysis,":[106],"tailored":[107],"Rust,":[109],"identify":[111],"track":[114],"them":[115],"across":[116],"crate":[117,162],"boundaries.":[120],"In":[121,139,186,199],"cases":[123],"(69.2%)":[124],"flagged":[128],"decide":[131],"whether":[132],"locally.":[138],"some":[140],"cases,":[141],"however,":[142],"safety":[144],"an":[146],"effect":[147],"depends":[148],"calling":[151],"context":[152],"how":[154],"function":[156],"called,":[158],"by":[160],"developer":[164],"imports":[165],"later.":[166],"Hence,":[167],"tracks":[170],"context-dependent":[171],"information":[172],"using":[173],"call-graph,":[175],"collects":[177],"results":[179],"into":[180],"composable":[181],"reusable":[183],"files.":[185],"this":[187],"paper,":[188],"describe":[190],"our":[191,216],"experience":[192,217],"crates":[195,266,273],"with":[196],"Scan.":[198],"particular,":[200],"popular":[204],"client":[205],"server":[207],"HTTP":[208],"crate,":[209],"hyper,":[210],"all":[212],"its":[214],"dependencies;":[215],"shows":[218],"reduce":[223],"burden":[226],"median":[233],"0.2%":[235],"lines":[237],"when":[240],"compared":[241],"whole":[244],"crates.":[245,295],"Looking":[246],"at":[247],"ecosystem":[250],"more":[251],"broadly,":[252],"find":[254,280],"automatically":[259],"classify":[260],"~3.5K":[261],"top":[264],"10K":[265],"crates.io":[268],"safe;":[270],"do":[275],"require":[276],"manual":[277],"inspection,":[278],"concentrated":[289],"roughly":[291],"3%":[292]},"counts_by_year":[],"updated_date":"2026-10-12T09:40:04.860316","created_date":"2026-02-10T00:00:00"}